Issued:
2022-06-13
Updated:
2022-06-13

RHSA-2022:4992 - Security Advisory

Synopsis

Important: xz security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for xz is now available for Red Hat Enterprise Linux 8.2 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

XZ Utils is an integrated collection of user-space file compression utilities based on the Lempel-Ziv-Markov chain algorithm (LZMA), which performs lossless data compression. The algorithm provides a high compression ratio while keeping the decompression time short.

Security Fix(es):

  • gzip: arbitrary-file-write vulnerability (CVE-2022-1271)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.2 x86_64
  • Red Hat Enterprise Linux Server - AUS 8.2 x86_64
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.2 s390x
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.2 ppc64le
  • Red Hat Enterprise Linux Server - TUS 8.2 x86_64
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.2 aarch64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.2 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.2 x86_64
  • Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 8.2 x86_64
  • Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 8.2 ppc64le
  • Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 8.2 s390x
  • Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 8.2 aarch64

Fixes

  • BZ - 2073310 - CVE-2022-1271 gzip: arbitrary-file-write vulnerability

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.2

SRPM
xz-5.2.4-4.el8_2.src.rpm SHA-256: 5206db38df3d0d36ca9468616a9ebdff482ee59ebb98cb4795b0d7e615059add
x86_64
xz-5.2.4-4.el8_2.x86_64.rpm SHA-256: 376be7c5a400295092ef517184b7700a7dd79e34d824b645758f905b6a298382
xz-debuginfo-5.2.4-4.el8_2.i686.rpm SHA-256: 21d4af297b95e4a4f09ae5bbe8e54f8cfacd6da86d36a134e341ca787f4c4ea5
xz-debuginfo-5.2.4-4.el8_2.x86_64.rpm SHA-256: e9ec0fb04760aadb2a0c5d356005af30d01b1e6ca835cd5e6fc00071d7625790
xz-debugsource-5.2.4-4.el8_2.i686.rpm SHA-256: f563edf3f75e9411181a06c888c80a92be2b6cf464768a72d99279dcc3013c77
xz-debugsource-5.2.4-4.el8_2.x86_64.rpm SHA-256: 098b04530de81820a38e319d9139ad29107b9bd0ed6f49c76446dc15ebda5977
xz-devel-5.2.4-4.el8_2.i686.rpm SHA-256: f7c801236eac1c02ee590371f5efad9abce7cce36f92f6f35117cf7b86ebd7e5
xz-devel-5.2.4-4.el8_2.x86_64.rpm SHA-256: 9626af9fed6b7abda55de2745981ce99191591ead3a6a5aaa1afd948ae979208
xz-libs-5.2.4-4.el8_2.i686.rpm SHA-256: adf16846d646ed06689128c4312ef587da20d79c2d5b79c37df7b8530eedd1bb
xz-libs-5.2.4-4.el8_2.x86_64.rpm SHA-256: e1d57d8b1ae62f51c22a632c02b3511ac78ef4c45a5ba6127f46cdd52bcf63a3
xz-libs-debuginfo-5.2.4-4.el8_2.i686.rpm SHA-256: 47036e310e923b980bce95f7d5d3c49edb58b20895d5b24bd490282ebf8da021
xz-libs-debuginfo-5.2.4-4.el8_2.x86_64.rpm SHA-256: 1e1a8fa1f1347b857fd3426cffd6a6cec4dc3bc66b7a352df28001a86da86d2a
xz-lzma-compat-debuginfo-5.2.4-4.el8_2.i686.rpm SHA-256: 4da27bfb80d422585aaab32c075d767e5a40f4809d87e22985f840ace806e3aa
xz-lzma-compat-debuginfo-5.2.4-4.el8_2.x86_64.rpm SHA-256: 4aee3590117b4fc81741bbc01d9ffd7f14b90576fcecbe60ccc4cf50dc0880ec

Red Hat Enterprise Linux Server - AUS 8.2

SRPM
xz-5.2.4-4.el8_2.src.rpm SHA-256: 5206db38df3d0d36ca9468616a9ebdff482ee59ebb98cb4795b0d7e615059add
x86_64
xz-5.2.4-4.el8_2.x86_64.rpm SHA-256: 376be7c5a400295092ef517184b7700a7dd79e34d824b645758f905b6a298382
xz-debuginfo-5.2.4-4.el8_2.i686.rpm SHA-256: 21d4af297b95e4a4f09ae5bbe8e54f8cfacd6da86d36a134e341ca787f4c4ea5
xz-debuginfo-5.2.4-4.el8_2.x86_64.rpm SHA-256: e9ec0fb04760aadb2a0c5d356005af30d01b1e6ca835cd5e6fc00071d7625790
xz-debugsource-5.2.4-4.el8_2.i686.rpm SHA-256: f563edf3f75e9411181a06c888c80a92be2b6cf464768a72d99279dcc3013c77
xz-debugsource-5.2.4-4.el8_2.x86_64.rpm SHA-256: 098b04530de81820a38e319d9139ad29107b9bd0ed6f49c76446dc15ebda5977
xz-devel-5.2.4-4.el8_2.i686.rpm SHA-256: f7c801236eac1c02ee590371f5efad9abce7cce36f92f6f35117cf7b86ebd7e5
xz-devel-5.2.4-4.el8_2.x86_64.rpm SHA-256: 9626af9fed6b7abda55de2745981ce99191591ead3a6a5aaa1afd948ae979208
xz-libs-5.2.4-4.el8_2.i686.rpm SHA-256: adf16846d646ed06689128c4312ef587da20d79c2d5b79c37df7b8530eedd1bb
xz-libs-5.2.4-4.el8_2.x86_64.rpm SHA-256: e1d57d8b1ae62f51c22a632c02b3511ac78ef4c45a5ba6127f46cdd52bcf63a3
xz-libs-debuginfo-5.2.4-4.el8_2.i686.rpm SHA-256: 47036e310e923b980bce95f7d5d3c49edb58b20895d5b24bd490282ebf8da021
xz-libs-debuginfo-5.2.4-4.el8_2.x86_64.rpm SHA-256: 1e1a8fa1f1347b857fd3426cffd6a6cec4dc3bc66b7a352df28001a86da86d2a
xz-lzma-compat-debuginfo-5.2.4-4.el8_2.i686.rpm SHA-256: 4da27bfb80d422585aaab32c075d767e5a40f4809d87e22985f840ace806e3aa
xz-lzma-compat-debuginfo-5.2.4-4.el8_2.x86_64.rpm SHA-256: 4aee3590117b4fc81741bbc01d9ffd7f14b90576fcecbe60ccc4cf50dc0880ec

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.2

SRPM
xz-5.2.4-4.el8_2.src.rpm SHA-256: 5206db38df3d0d36ca9468616a9ebdff482ee59ebb98cb4795b0d7e615059add
s390x
xz-5.2.4-4.el8_2.s390x.rpm SHA-256: ddfb1e619e7257e1184bd715c7aecb662c00ab22ec8a89c1f77c24dacef65f1e
xz-debuginfo-5.2.4-4.el8_2.s390x.rpm SHA-256: 2044c5b12eb4ddf75a3fb5e5891102d1a69479292b857712fd94f7f16c79124e
xz-debugsource-5.2.4-4.el8_2.s390x.rpm SHA-256: 665a99e53175df8b9ea5cecff903e29bf0f46a23f1507747c2327e318518f2f5
xz-devel-5.2.4-4.el8_2.s390x.rpm SHA-256: 65a3b2229cd640275ce75e82dd38ba12e434582ccee77dcf7747d04cd56110fc
xz-libs-5.2.4-4.el8_2.s390x.rpm SHA-256: 2b06cc4e5f953c7e2c0fba5d6f05495458391746d79992de55407fafdf8ff4d4
xz-libs-debuginfo-5.2.4-4.el8_2.s390x.rpm SHA-256: 5d066ab7ff8f401c757ce1c188044af0293866cda47e517e4f37f0339d9ed9ee
xz-lzma-compat-debuginfo-5.2.4-4.el8_2.s390x.rpm SHA-256: fcc7efa312605f3203cf12c07327fccd7264fb66fa847dd899997ff9036f754a

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.2

SRPM
xz-5.2.4-4.el8_2.src.rpm SHA-256: 5206db38df3d0d36ca9468616a9ebdff482ee59ebb98cb4795b0d7e615059add
ppc64le
xz-5.2.4-4.el8_2.ppc64le.rpm SHA-256: f82167e6cc9d98fdeb67c1844e9fba5570144f9cafa163f7683de5e18dd554b9
xz-debuginfo-5.2.4-4.el8_2.ppc64le.rpm SHA-256: 442f498be2f5dfd740a0942fb2f62fb3ae83d43e7edc7188004a8685026fd91e
xz-debugsource-5.2.4-4.el8_2.ppc64le.rpm SHA-256: cff4033b9d243ec3bf40f56552b9e74dedb2e694d7137c5f500dea8b2498e5d6
xz-devel-5.2.4-4.el8_2.ppc64le.rpm SHA-256: 29ae8cc5fa9d1b47a0c76440b7fb1b33f51195a26cf5e397075ca7a34afec12c
xz-libs-5.2.4-4.el8_2.ppc64le.rpm SHA-256: bf20a6c4691d4c8ec26e605e69304559c6f6abcfee937e50c5391bc9a318e12a
xz-libs-debuginfo-5.2.4-4.el8_2.ppc64le.rpm SHA-256: 3021d58292b98a1a1061a8af6a3b96f6f83748d65ada1b210b62343dff77d646
xz-lzma-compat-debuginfo-5.2.4-4.el8_2.ppc64le.rpm SHA-256: 4c1b06bf74ca2dda2b0d6b62edbe9b520c2ec8123d4af1a9cc315b19d1a77d71

Red Hat Enterprise Linux Server - TUS 8.2

SRPM
xz-5.2.4-4.el8_2.src.rpm SHA-256: 5206db38df3d0d36ca9468616a9ebdff482ee59ebb98cb4795b0d7e615059add
x86_64
xz-5.2.4-4.el8_2.x86_64.rpm SHA-256: 376be7c5a400295092ef517184b7700a7dd79e34d824b645758f905b6a298382
xz-debuginfo-5.2.4-4.el8_2.i686.rpm SHA-256: 21d4af297b95e4a4f09ae5bbe8e54f8cfacd6da86d36a134e341ca787f4c4ea5
xz-debuginfo-5.2.4-4.el8_2.x86_64.rpm SHA-256: e9ec0fb04760aadb2a0c5d356005af30d01b1e6ca835cd5e6fc00071d7625790
xz-debugsource-5.2.4-4.el8_2.i686.rpm SHA-256: f563edf3f75e9411181a06c888c80a92be2b6cf464768a72d99279dcc3013c77
xz-debugsource-5.2.4-4.el8_2.x86_64.rpm SHA-256: 098b04530de81820a38e319d9139ad29107b9bd0ed6f49c76446dc15ebda5977
xz-devel-5.2.4-4.el8_2.i686.rpm SHA-256: f7c801236eac1c02ee590371f5efad9abce7cce36f92f6f35117cf7b86ebd7e5
xz-devel-5.2.4-4.el8_2.x86_64.rpm SHA-256: 9626af9fed6b7abda55de2745981ce99191591ead3a6a5aaa1afd948ae979208
xz-libs-5.2.4-4.el8_2.i686.rpm SHA-256: adf16846d646ed06689128c4312ef587da20d79c2d5b79c37df7b8530eedd1bb
xz-libs-5.2.4-4.el8_2.x86_64.rpm SHA-256: e1d57d8b1ae62f51c22a632c02b3511ac78ef4c45a5ba6127f46cdd52bcf63a3
xz-libs-debuginfo-5.2.4-4.el8_2.i686.rpm SHA-256: 47036e310e923b980bce95f7d5d3c49edb58b20895d5b24bd490282ebf8da021
xz-libs-debuginfo-5.2.4-4.el8_2.x86_64.rpm SHA-256: 1e1a8fa1f1347b857fd3426cffd6a6cec4dc3bc66b7a352df28001a86da86d2a
xz-lzma-compat-debuginfo-5.2.4-4.el8_2.i686.rpm SHA-256: 4da27bfb80d422585aaab32c075d767e5a40f4809d87e22985f840ace806e3aa
xz-lzma-compat-debuginfo-5.2.4-4.el8_2.x86_64.rpm SHA-256: 4aee3590117b4fc81741bbc01d9ffd7f14b90576fcecbe60ccc4cf50dc0880ec

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.2

SRPM
xz-5.2.4-4.el8_2.src.rpm SHA-256: 5206db38df3d0d36ca9468616a9ebdff482ee59ebb98cb4795b0d7e615059add
aarch64
xz-5.2.4-4.el8_2.aarch64.rpm SHA-256: 5622a7651664c2a6ce79a545722a89276fb7041d4540c5cdb2f0dc4c0d610da4
xz-debuginfo-5.2.4-4.el8_2.aarch64.rpm SHA-256: 49badb1c97357da8bc9e7b54c1710aa4c3da03ea2b41e00061dec5218ca57c30
xz-debugsource-5.2.4-4.el8_2.aarch64.rpm SHA-256: 1c6f692f4d2e2ef36fc25a0dcde42dc8ec013cb5559495404d7482c812c1ce63
xz-devel-5.2.4-4.el8_2.aarch64.rpm SHA-256: dbabc609ffa27552bd891e2d95988e02297f82eb88958d07a1f1c76a4407b337
xz-libs-5.2.4-4.el8_2.aarch64.rpm SHA-256: bd450ea00792fb6ffdc75ff69c6d1092b398b167d28e103056aff67e0983c37b
xz-libs-debuginfo-5.2.4-4.el8_2.aarch64.rpm SHA-256: 60f882b28e015e497c171dc00aec43e2275cf39b7c329317d9ed08f7cd0786ee
xz-lzma-compat-debuginfo-5.2.4-4.el8_2.aarch64.rpm SHA-256: 4e804e8105f9a45a188df5e28d02550975ca5e4363891f900516b0e16b2725b4

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.2

SRPM
xz-5.2.4-4.el8_2.src.rpm SHA-256: 5206db38df3d0d36ca9468616a9ebdff482ee59ebb98cb4795b0d7e615059add
ppc64le
xz-5.2.4-4.el8_2.ppc64le.rpm SHA-256: f82167e6cc9d98fdeb67c1844e9fba5570144f9cafa163f7683de5e18dd554b9
xz-debuginfo-5.2.4-4.el8_2.ppc64le.rpm SHA-256: 442f498be2f5dfd740a0942fb2f62fb3ae83d43e7edc7188004a8685026fd91e
xz-debugsource-5.2.4-4.el8_2.ppc64le.rpm SHA-256: cff4033b9d243ec3bf40f56552b9e74dedb2e694d7137c5f500dea8b2498e5d6
xz-devel-5.2.4-4.el8_2.ppc64le.rpm SHA-256: 29ae8cc5fa9d1b47a0c76440b7fb1b33f51195a26cf5e397075ca7a34afec12c
xz-libs-5.2.4-4.el8_2.ppc64le.rpm SHA-256: bf20a6c4691d4c8ec26e605e69304559c6f6abcfee937e50c5391bc9a318e12a
xz-libs-debuginfo-5.2.4-4.el8_2.ppc64le.rpm SHA-256: 3021d58292b98a1a1061a8af6a3b96f6f83748d65ada1b210b62343dff77d646
xz-lzma-compat-debuginfo-5.2.4-4.el8_2.ppc64le.rpm SHA-256: 4c1b06bf74ca2dda2b0d6b62edbe9b520c2ec8123d4af1a9cc315b19d1a77d71

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.2

SRPM
xz-5.2.4-4.el8_2.src.rpm SHA-256: 5206db38df3d0d36ca9468616a9ebdff482ee59ebb98cb4795b0d7e615059add
x86_64
xz-5.2.4-4.el8_2.x86_64.rpm SHA-256: 376be7c5a400295092ef517184b7700a7dd79e34d824b645758f905b6a298382
xz-debuginfo-5.2.4-4.el8_2.i686.rpm SHA-256: 21d4af297b95e4a4f09ae5bbe8e54f8cfacd6da86d36a134e341ca787f4c4ea5
xz-debuginfo-5.2.4-4.el8_2.x86_64.rpm SHA-256: e9ec0fb04760aadb2a0c5d356005af30d01b1e6ca835cd5e6fc00071d7625790
xz-debugsource-5.2.4-4.el8_2.i686.rpm SHA-256: f563edf3f75e9411181a06c888c80a92be2b6cf464768a72d99279dcc3013c77
xz-debugsource-5.2.4-4.el8_2.x86_64.rpm SHA-256: 098b04530de81820a38e319d9139ad29107b9bd0ed6f49c76446dc15ebda5977
xz-devel-5.2.4-4.el8_2.i686.rpm SHA-256: f7c801236eac1c02ee590371f5efad9abce7cce36f92f6f35117cf7b86ebd7e5
xz-devel-5.2.4-4.el8_2.x86_64.rpm SHA-256: 9626af9fed6b7abda55de2745981ce99191591ead3a6a5aaa1afd948ae979208
xz-libs-5.2.4-4.el8_2.i686.rpm SHA-256: adf16846d646ed06689128c4312ef587da20d79c2d5b79c37df7b8530eedd1bb
xz-libs-5.2.4-4.el8_2.x86_64.rpm SHA-256: e1d57d8b1ae62f51c22a632c02b3511ac78ef4c45a5ba6127f46cdd52bcf63a3
xz-libs-debuginfo-5.2.4-4.el8_2.i686.rpm SHA-256: 47036e310e923b980bce95f7d5d3c49edb58b20895d5b24bd490282ebf8da021
xz-libs-debuginfo-5.2.4-4.el8_2.x86_64.rpm SHA-256: 1e1a8fa1f1347b857fd3426cffd6a6cec4dc3bc66b7a352df28001a86da86d2a
xz-lzma-compat-debuginfo-5.2.4-4.el8_2.i686.rpm SHA-256: 4da27bfb80d422585aaab32c075d767e5a40f4809d87e22985f840ace806e3aa
xz-lzma-compat-debuginfo-5.2.4-4.el8_2.x86_64.rpm SHA-256: 4aee3590117b4fc81741bbc01d9ffd7f14b90576fcecbe60ccc4cf50dc0880ec

Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 8.2

SRPM
x86_64
xz-debuginfo-5.2.4-4.el8_2.x86_64.rpm SHA-256: e9ec0fb04760aadb2a0c5d356005af30d01b1e6ca835cd5e6fc00071d7625790
xz-debugsource-5.2.4-4.el8_2.x86_64.rpm SHA-256: 098b04530de81820a38e319d9139ad29107b9bd0ed6f49c76446dc15ebda5977
xz-libs-debuginfo-5.2.4-4.el8_2.x86_64.rpm SHA-256: 1e1a8fa1f1347b857fd3426cffd6a6cec4dc3bc66b7a352df28001a86da86d2a
xz-lzma-compat-5.2.4-4.el8_2.x86_64.rpm SHA-256: 515a89e312c7d3da72b888f0f174e01104111eda48551154118b5e6d0ac7dcc4
xz-lzma-compat-debuginfo-5.2.4-4.el8_2.x86_64.rpm SHA-256: 4aee3590117b4fc81741bbc01d9ffd7f14b90576fcecbe60ccc4cf50dc0880ec

Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 8.2

SRPM
ppc64le
xz-debuginfo-5.2.4-4.el8_2.ppc64le.rpm SHA-256: 442f498be2f5dfd740a0942fb2f62fb3ae83d43e7edc7188004a8685026fd91e
xz-debugsource-5.2.4-4.el8_2.ppc64le.rpm SHA-256: cff4033b9d243ec3bf40f56552b9e74dedb2e694d7137c5f500dea8b2498e5d6
xz-libs-debuginfo-5.2.4-4.el8_2.ppc64le.rpm SHA-256: 3021d58292b98a1a1061a8af6a3b96f6f83748d65ada1b210b62343dff77d646
xz-lzma-compat-5.2.4-4.el8_2.ppc64le.rpm SHA-256: 77d703bb7a903b213ae294751d85c23a83ecc0bb55bcd8739b35a689a989270a
xz-lzma-compat-debuginfo-5.2.4-4.el8_2.ppc64le.rpm SHA-256: 4c1b06bf74ca2dda2b0d6b62edbe9b520c2ec8123d4af1a9cc315b19d1a77d71

Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 8.2

SRPM
s390x
xz-debuginfo-5.2.4-4.el8_2.s390x.rpm SHA-256: 2044c5b12eb4ddf75a3fb5e5891102d1a69479292b857712fd94f7f16c79124e
xz-debugsource-5.2.4-4.el8_2.s390x.rpm SHA-256: 665a99e53175df8b9ea5cecff903e29bf0f46a23f1507747c2327e318518f2f5
xz-libs-debuginfo-5.2.4-4.el8_2.s390x.rpm SHA-256: 5d066ab7ff8f401c757ce1c188044af0293866cda47e517e4f37f0339d9ed9ee
xz-lzma-compat-5.2.4-4.el8_2.s390x.rpm SHA-256: c874310301e758e0438a7c312bd42c5f5c95a2c13670056bcf55018752435a19
xz-lzma-compat-debuginfo-5.2.4-4.el8_2.s390x.rpm SHA-256: fcc7efa312605f3203cf12c07327fccd7264fb66fa847dd899997ff9036f754a

Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 8.2

SRPM
aarch64
xz-debuginfo-5.2.4-4.el8_2.aarch64.rpm SHA-256: 49badb1c97357da8bc9e7b54c1710aa4c3da03ea2b41e00061dec5218ca57c30
xz-debugsource-5.2.4-4.el8_2.aarch64.rpm SHA-256: 1c6f692f4d2e2ef36fc25a0dcde42dc8ec013cb5559495404d7482c812c1ce63
xz-libs-debuginfo-5.2.4-4.el8_2.aarch64.rpm SHA-256: 60f882b28e015e497c171dc00aec43e2275cf39b7c329317d9ed08f7cd0786ee
xz-lzma-compat-5.2.4-4.el8_2.aarch64.rpm SHA-256: 868e9b0d786fb573ade26754366569b6b16862275634cf6e93eb6dc6c03e7d9c
xz-lzma-compat-debuginfo-5.2.4-4.el8_2.aarch64.rpm SHA-256: 4e804e8105f9a45a188df5e28d02550975ca5e4363891f900516b0e16b2725b4

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.